Signature payload matching

Zeek
1

The matching is done against all the session for TCP sessions.
For UDP sessions, it is much like a per packet matching.

R. Alahassa